matrix-org / matrix-org/matrix-spec

Unexpected powerlevels interactions

Open
#1,267 0 comments 0 reactions 0 assignees View on GitHub
wart
Dominant language
HTML
Stars
330
Forks
150
Avg merge
2h 21m
Merged PRs (30d)
3

Description

We accept some PL event transitions that are maybe unexpected.

Suppose we have a room where:
* `events."m.room.power_levels"` has been lowered to 50 (ie, "moderators" have been allowed to change the power levels)
* `users."@mischievous_mod:example.com"` is 50 (ie, they are a moderator)
* `events_default` is 75, so `@mischievous_mod` (and other users) cannot send arbitrary events.

Now:

1. `@mischievous_mod` can add new entries to `events`, thus allowing themselves (or other users) to send events. This appears to be counter to the spirit of point 10.4.1 of the [auth rules](https://spec.matrix.org/v1.4/rooms/v1/#authorization-rules):

> For each entry being added ... in both the events and users keys: if the current value is higher than the `sender`’s current power level, reject.

... which seems to seek to prevent the sender of a PL event from controlling the transmission of events that they themselves do not have permission to send.

2. Conversely, suppose there is an existing entry in `events` setting `"m.room.message": 0`. The mischievous moderator can *remove* this entry, thus changing the required PL for sending such an event to the default (75). This appears to be counter to the spirit of point 10.4.2:

> If the new value is higher than the `sender`’s current power level, reject.

... which seems to seek to prevent the sender of a PL event from preventing other users with the same PL from sending that event.

Suppose now that `users_default` is 75.

3. `@mischievous_mod` can add an entry to the `users` key *demoting* another user with a higher power level than themselves.
4. `@mischievous_mod` can *remove* an entry from the `users` key, *promoting* another user (or themselves) to a higher power level than their own.

Contributor guide

Open the contributing guide

Research direction

Start with the authorization rules section linked in the issue and compare its wording with the four power-level transitions described here. Determine whether these behaviors are intended or require a specification change; done requires a decided interpretation and an agreed update to the Matrix specification.

Written by the indexing model from the issue text.

Assessment

Domain
authorization, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.